USN-6260-1 linux-aws-5.19, linux-gcp-5.19, linux-hwe-5.19 vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly check buffer indexes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information kernel memory. CVE-2022-48502...

USN-6255-1 linux-intel-iotg-5.15 vulnerabilities

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-3090...

apache-commons-io:InputXmlFuzzer: Security exception in java.base/java.util.regex.Pattern$Loop.match

Detailed Report: https://oss-fuzz.com/testcase?key=5305025839366144 Project: apache-commons-io Fuzzing Engine: libFuzzer Fuzz Target: InputXmlFuzzer Job Type: libfuzzerasanapache-commons-io Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

USN-6248-1 linux-oem-6.0 vulnerabilities

It was discovered that the network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service system crash. CVE-2022-47929 It was discovered that a race condition existed in Adreno GPU...

USN-6246-1 linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

It was discovered that the IP-VLAN network driver for the Linux kernel did not properly initialize memory in some situations, leading to an out-of- bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-3090...

Oracle WebCenter Sites (Jul 2023 CPU)

The 12.2.1.4.0 version of WebCenter Sites installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites XStream. The supported version...

USN-6235-1 linux-oem-6.0 vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service system crash. CVE-2022-4842 Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel di...

Security Bulletin: Vulberability in Apache commons io library affects IBM Engineering Test Management (ETM) (CVE-2021-29425)

Summary This Security Vulnerablity has been addressed in IBM Engineering Test Management. A fix is available to address the vulnerability. Vulnerability Details CVEID:CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by...

WordPress Guild Raid Progression for WoW and Raider IO Plugin < 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Guild Raid Progression for WoW and Raider IO Type Plugin Vulnerable versions 1.0.3 Fixed in 1.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 44f4e0b3ae81 Credits Rafie...

Malicious code in foxy.io-serverless-functions-on-netlify-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31fcc1352ebaac1135e5fad045763c61fc9666c1968dbd91fe87951dd50882ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-19029

Name of the Vulnerable Software and Affected Versions Milesight UR32L version 32.3.0.5 Description A directory traversal issue exists in the luci2-io file-export mib functionality. This allows an attacker to send a specially crafted network request, potentially leading to arbitrary file read...

A Bootiful Podcast: Jetbrains' Anton Arhipov on IntelliJ, Java, and so much more

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! This week Josh Long talks to Jetbrain's developer advocate Anton Arhipov, recorded live from the amazing Spring IO show in Barcelona, Spain!...

Milesight UR32L luci2-io file-export mib directory traversal vulnerability

Talos Vulnerability Report TALOS-2023-1695 Milesight UR32L luci2-io file-export mib directory traversal vulnerability July 6, 2023 CVE Number CVE-2023-23547 SUMMARY A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially...

CVE-2023-23547: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary file read. An attacker can send a network request to trigger this vulnerability...

Juniper Networks SNMPD DoS

The vulnerability of packeIO in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to insufficient handling of exceptional conditions. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Cross site request forgery (csrf)

The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epiosendautosuggestallowed function. This makes it possible for unauthenticated attackers to send allowed paramete...

CVE-2021-4405 ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass

The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epiosendautosuggestallowed function. This makes it possible for unauthenticated attackers to send allowed paramete...

engine.io: Specially crafted HTTP request can trigger an uncaught exception

A flaw was found in engine.io. The Socket.IO Engine.IO is vulnerable to a denial of service caused by an uncaught exception flaw. By sending a specially-crafted HTTP request, a remote, authenticated attacker can cause the Node.js process to crash, resulting in a denial of service...

USN-6194-1 linux-oem-6.1 vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 Xingyuan Mo and Gengjia Chen...

USN-6192-1 linux, linux-allwinner, linux-allwinner-5.19, linux-aws, linux-aws-5.19, linux-azure, linux-gcp, linux-gcp-5.19, linux-hwe-5.19, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux-starfive, linux-starfive-5.19 vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 Xingyuan Mo and Gengjia Chen...